ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203

General

Target

ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe
Size

697KB
MD5

4d0bba821fc581a72499ee57fff121f8
SHA1

749b8a396d343392a754ebde5727388e4e8830f4
SHA256

ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203
SHA512

aa852708597bbca2ecad9f45b369ac8220519ece3c1e806cce5acce9758880915a7d108c3a64d18033fc182a6d831de7e8cc7d47928bf170241e027f2a67cace
SSDEEP

12288:7Kc8V/xSKG7rKdkOOERvOQ4XScBMcuvVaqxQduDl5xCeRXU:H7rWkAKXd4v4yTC+

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2620	powershell.exe
2540	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1244 set thread context of 2040	1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2644	2040	WerFault.exe	34

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe
1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe
1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe
1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe
1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe
1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe
1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe
2540	powershell.exe
2620	powershell.exe
2040	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe
Token: SeDebugPrivilege	2540	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2620	1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	28
PID 1244 wrote to memory of 2620	1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	28
PID 1244 wrote to memory of 2620	1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	28
PID 1244 wrote to memory of 2620	1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	28
PID 1244 wrote to memory of 2540	1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	30
PID 1244 wrote to memory of 2540	1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	30
PID 1244 wrote to memory of 2540	1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	30
PID 1244 wrote to memory of 2540	1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	30
PID 1244 wrote to memory of 2664	1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	31
PID 1244 wrote to memory of 2664	1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	31
PID 1244 wrote to memory of 2664	1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	31
PID 1244 wrote to memory of 2664	1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	31
PID 1244 wrote to memory of 2040	1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	34
PID 1244 wrote to memory of 2040	1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	34
PID 1244 wrote to memory of 2040	1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	34
PID 1244 wrote to memory of 2040	1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	34
PID 1244 wrote to memory of 2040	1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	34
PID 1244 wrote to memory of 2040	1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	34
PID 1244 wrote to memory of 2040	1244	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	34
PID 2040 wrote to memory of 2644	2040	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	35
PID 2040 wrote to memory of 2644	2040	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	35
PID 2040 wrote to memory of 2644	2040	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	35
PID 2040 wrote to memory of 2644	2040	ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe	35

C:\Users\Admin\AppData\Local\Temp\ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe
"C:\Users\Admin\AppData\Local\Temp\ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2620
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CfedwzvgnSqYH.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2540
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CfedwzvgnSqYH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7697.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2664
- C:\Users\Admin\AppData\Local\Temp\ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe
  "C:\Users\Admin\AppData\Local\Temp\ff90309a7ad512ec8dca705e4d9ca3d9e63b849d158e9855a7318ec0b9c2b203.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 36
    3⤵
    - Program crash
    PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7697.tmp

Filesize
1KB

MD5
79972d1e2b5ac18f13fb9a184907270d

SHA1
a01902c9add5f8596ec6c0cb5adb9e099e61b7d8

SHA256
cec0f400195c68db94a8871a63d1ca8b189733ecfc1f0c21e123425a684ddf7d

SHA512
5c74c2067ba3fa1716e3df690f8d173933690871dcccacebbb94eb88d77dc0fd7f12c0bc8782bbe024d9a8379ebbb3df070d89c788fb2ef368436394fbb904d3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
e508382723f7f5eeae8036e806241399

SHA1
9390a554a76252c2c17af8f48c709682714592fa

SHA256
f96903b2b92561d1b2475ca1bb11c12865da21b7a0f10633c9ae0c4b02bf13b7

SHA512
8228a889c7c38b4ce60ca40b2a8c023431cf1817ee5c0b5e075a3ec0eaed037a7897f1149ab845d1a23742c6fb5acd54f5bcd3912abb3159fef0bac70dc18784

Download Submit
memory/1244-6-0x0000000004F40000-0x0000000004FCA000-memory.dmp

Filesize
552KB

Download
memory/1244-3-0x00000000001D0000-0x00000000001E6000-memory.dmp

Filesize
88KB

Download
memory/1244-4-0x00000000004C0000-0x00000000004CC000-memory.dmp

Filesize
48KB

Download
memory/1244-5-0x00000000004D0000-0x00000000004E0000-memory.dmp

Filesize
64KB

Download
memory/1244-0-0x000000007480E000-0x000000007480F000-memory.dmp

Filesize
4KB

Download
memory/1244-2-0x0000000074800000-0x0000000074EEE000-memory.dmp

Filesize
6.9MB

Download
memory/1244-1-0x0000000000A70000-0x0000000000B24000-memory.dmp

Filesize
720KB

Download
memory/1244-25-0x0000000074800000-0x0000000074EEE000-memory.dmp

Filesize
6.9MB

Download
memory/2040-20-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2040-24-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2040-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2040-21-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads